Reading MRT dumps without a PhD in suffering

Cara, this is going to save your life if you ever get stuck parsing BGP tables at 3am kkkkk

So you got your MRT dump from some route collector or your upstream gave you a fat binary and now you cry because the docs look like they were written by a sadist. Véi, I feel you.

step 1: do not use the reference parser
That thing is a trap. It ate 16GB of RAM and still segfault on a malformed attribute. Use bgpdump or go straight to

mrtparse

from mrtparse import *
for entry in Reader('latest.mrt'):
print(entry.data['bgp_message']['nlri'])

step 2: filter early, filter often
You do not need the full table. grep for your ASN, your prefix, whatever. The collectors at Contabo and OVHcloud give you dumps every 2 hours, they are huge if you slurp everything.

step 3: timestamps matter
MRT has two formats. If you see weird 1970 dates, you looking at the old 16-bit AS format. You need

-s

bonus: I share my one-liner for finding hijacks in historical dumps. Works on any linux box, no PhD required kkkkk

bgpdump -m latest.mrt | awk -F'|' '$6 ~ /198644|64496/ {print $2, $6, $7}'

Cara I wrote this whole thing because I lied in a job interview and said I "routinely analyze global routing stability" kkkkkk now I actually had to learn it véi pray for me

Going to try this on my home lab setup

I always thought MRT was some dark art only the big tier-1 wizards touched good to see it broken down for mere mortals like us

One thing I do not get though — why do some dumps show multiple withdrawals for the same prefix in the same minute Is that normal or am I holding it wrong